Home > Technology and the CEO: Information Security Technology

Features

Technology and the CEO: Information Security Technology

10/26/2005

By Thomas Keith Meier

Some college presidents are well-versed in many of the internal aspects of information technology, while others, like me, merely admire the many benefits it offers. However, recent widespread and well-publicized security threats, as well as the opportunity to contribute this chapter, have raised my own level of awareness of information technology (IT), and I wish to thank two of my tutors in the field who are the principal contributors to this discussion: Scott Lowe, director of Information Technology, and Michael Rogers, director of Communications, both at Elmira College (NY).

There was once a day when a college could connect its campus—along with every student—to the Internet, and not have to worry much about security. The primary threat was from students who attempted to hack the college administrative systems in an effort to boost their (perhaps lackluster) grades. Those days are gone.

Of course, a college still needs to worry about the occasional computer-savvy underachiever, but today’s threats to campus information security are much more serious and sophisticated. Among the threats to college campuses today are:

Identity theft: a crime in which an imposter gains access to someone’s personal information and uses it to impersonate the innocent victim. This crime is of particular concern to college campuses, either due to historically lax policies or the use of unprotected social security numbers as student identification numbers.

Hacking and data theft: a crime in which a person gains unauthorized access to key systems, and steals sensitive data. This is sometimes followed up by actual identity theft.

Viruses and spyware: Viruses have been around for a long time, but spyware—generally, tracking software that watches what users do and reports activity to a home base—is a relatively new phenomenon that can have serious security consequences if left unchecked.

Because of these issues and the explosion of all things Internet, IT security has quickly moved from a back-burner, “would-be-nice-if” task to a critical and ongoing investment for any campus that relies on technology for its services. Information security often is compared to a war in which the allies need to stay one step ahead of the enemy. Presidents and other senior leaders must take steps to ensure that the college is always one step ahead. What are some ways to achieve this evermore elusive goal?

IT Security Goal: One Step Ahead

Probably the most important security goal is identifying the campus risk areas. Most college administrators have read about the unfortunate situation at George Mason University (VA) in early 2005. In short, attackers gained access to sensitive campus systems and may have snatched as many as 30,000 personal student and employee records, including social security numbers. This is not the kind of publicity that any institution seeks. In this case, one major risk area for George Mason was its administrative system’s use of the social security number as a student identifier. Ironically, the university was in the process of converting to an unrelated student identifier at the time of the security breach.



Recommended Reading